[jdp23]

> I'm not using "software QA" in the very broad way you describe in the first sentence.

I took this description from your earlier comment "I call it "poor software QA" because 1) and 2)" so yes, you are using it that way at least sometimes :)

Anyhow we obviously see things differently on the root cause side (and both of us are on the outside so there's a lot we don't know). That said I certainly agree that it's a defect, and that it's an attack that could reasonably have been anticipated.